Authenticated file disclosure via unvalidated import paths

Path traversal in RAGFlow 0 through 0.27.2 allows remote authenticated users to read service-accessible JSON files via tenant imports. The dev_insert_chunks_from_file and dev_insert_metadata_from_file handlers pass the request's file_path directly to os.ReadFile without restricting absolute paths or enforcing an import directory. A valid access token is required, and disclosure is limited to readable files matching the expected JSON structures, whose contents are then inserted into datasets.